login, logout work correctly

still working on other things that require $_SESSION